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The 128-Bit Blockcipher CLEFIA 
Abstract 


This document describes the specification of the blockcipher CLEFIA. 
CLEFIA is a 128-bit blockcipher, with key lengths of 128, 192, and 
256 bits, which is compatible with the interface of the Advanced 
Encryption Standard (AES). The algorithm of CLEFIA was published in 
2007, and its security has been scrutinized in the public community. 
CLEFIA is one of the new-generation lightweight blockcipher 
algorithms designed after AES. Among them, CLEFIA offers high 
performance in software and hardware as well as lightweight 
implementation in hardware.  CLEFIA will be of benefit to the 
Internet, which will be connected to more distributed and constrained 
devices. 


Status of This Memo 


This document is not an Internet Standards Track specification; it is 
published for informational purposes. 


This is a contribution to the RFC Series, independently of any other 
RFC stream. The RFC Editor has chosen to publish this document at 
its discretion and makes no statement about its value for 
implementation or deployment. Documents approved for publication by 
the RFC Editor are not a candidate for any level of Internet 
Standard; see Section 2 of RFC 5741. 


Information about the current status of this document, any errata, 


and how to provide feedback on it may be obtained at 
http://www.rfc-editor.org/info/rfc6114. 
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Les 


Introduction 


Due to the widespread use of the Internet, devices with limited 
capabilities, e.g., wireless sensors, are connected to the network. 
In order to realize enough security for the network, cryptographic 
technologies suitable for such constrained devices are very 
important. This recent technology is called "lightweight 
cryptography", and the demand for lightweight cryptography is 
increasing. 


In order to satisfy these needs, a 128-bit blockcipher, CLEFIA, was 


designed based on state-of-the-art techniques [FSE07].  CLEFIA is a 
128-bit blockcipher, with key lengths of 128, 192, and 256 bits, 
which is compatible with the interface of AES [FIPS-197]. Since the 


cipher algorithm was published in 2007, its security has been 
Scrutinized in the public community, but no security weaknesses have 
been reported so far. 


CLEFIA is a lightweight blockcipher, since it can be implemented 
within 3 Kgates using a 0.13-um standard Complementary Metal Oxide 
Semiconductor (CMOS) Application-Specific Integrated Circuit (ASIC) 
library. Many of the lightweight cryptographic algorithms sacrifice 
security and/or speed; however, CLEFIA provides high-level security 
of 128, 192, and 256 bits and high performance in software and 
hardware.  CLEFIA will be of benefit to the Internet, which will be 
connected to more distributed and resource-constrained devices. 


CLEFIA is proposed in ISO/IEC 29192-2 [1IS029192-2] and the CRYPTREC 
project for the revision of the e-Government recommended ciphers list 
in Japan [CRYPTREC]. 


Further information about CLEFIA, including reference implementation, 
test vectors, and security and performance evaluation, is available 
from http://www.sony.net/clefia/. 


Notations 


This section describes mathematical notations, conventions, and 
symbols used throughout this document. 


Ox : A prefix for a binary string in hexadecimal form 
alb or (a|b) : Concatenation of a and b 

(a,b) or (ab) : Vector style representation of alb 

a <- b : Updating a value of a by a value of b 

trans (a) : Transposition of a vector or a matrix a 

a XOR b : Bitwise exclusive-OR operation 


Katagi € Moriai Informational [Page 3] 


RFC 6114 The 128-Bit Blockcipher CLEFIA March 2011 


a : Logical negation 
a ««« b : b-bit left cyclic shift operation 
a^b : a raised to the power of b 
a * b : Multiplication in GF(2^n) over a defined polynomial 


3. CLEFIA Algorithm 


The CLEFIA algorithm consists of two parts: a data processing part 
and a key scheduling part. The data processing part of CLEFIA 
consists of functions ENCr for encryption and DECr for decryption. 
The encryption/decryption process is as follows: 


Step 1. Key scheduling 
Step 2. Encrypting/decrypting each block of data using ENCr/DECr 


The process of the key scheduling is described in Section 6, and the 
definitions of ENCr and DECr are explained in Section 5.  CLEFIA 
supports 128-bit, 192-bit, and 256-bit keys, and the key scheduling 
and ENCr/DECr should be appropriately selected for its key length. 


4.  CLEFIA Building Blocks 
4.1. GFN_{d,r} 


We first define the function GFN (d,r), which is a fundamental 
structure for CLEFIA, and then define a data processing part and a 
key scheduling part. 


CLEFIA uses a 4-branch and an 8-branch generalized Feistel network. 
The 4-branch generalized Feistel network is used in the data 
processing part and the key scheduling for a 128-bit key. The 
8-branch generalized Feistel network is applied in the key scheduling 
for a 192-bit/256-bit key. We denote the d-branch r-round 
generalized Feistel network employed in CLEFIA as GFN_{d,r}. 


For d pairs of 32-bit inputs Xi and outputs Yi (0 <= i « d), and dr/2 
32-bit round keys RK (i) (0 <= i « dr/2), GEN (d,r) (d = 4,8) is 
defined as follows. 
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GEN (4,r)(RK (0), ..., RK (2r-1), XO, X1, X2, X3) 
input 32-bit round keys RK (0), ..., RK (2r-1], 
32-bit data X0, X1, X2, X3, 
output: 32-bit data YO, Y1, Y2, Y3 


Step 1. TO | T1 | T2 | T3 <- X0 | x1 | x2 | x3 


Step 2. For i 0 to r - 1 do the following: 
Tl <- Tl XOR FO(RK_(2i),T0), 


T3 <- T3 XOR F1(RK_{2i + 1}, 


Step 2.1. 
T2) 


Step 2.2. TO | T1 | T2 | T3 <- T1 | 


Step 3. Y0 | Y1 


GFN (8,r) (RK_{0}, 


| y2 | Y3 <- T3 | TO | 


op RR aa); X0, Xip 2:25 


input 32-bit round keys RK (0), ., RK_{4r-1}, 
32-bit data X0, X1, X2, X3, X4, X5, X6, X7, 
output: 32-bit data YO, Y1, Y2, Y3, Y4, Y5, Y6, Y7 
Step 1. TO | Ti Ngee | T7 <= xo | Set.) | | x7 
Step 2. For i = 0 to r - 1 do the following: 
Step 2.1. T1 <- T1 XOR FO(RK (4i), TO), 
T3 <- T3 XOR F1(RK (4i + 1), T2), 
T5 «- T5 XOR FO(RK (4i + 2), T4), 
T7 <- T7 XOR F1(RK (4i + 3), T6) 
Step 2.2. TO | T1 | | T6 | T7 <- T1 | T2 | [are TO 
Step 3. Yo | và | | y6 | Y7 <- T7 | TO | | T5 | T6 


The inverse function GFNINV_{4,r} is obtained by changing the order 
of RK (i) and the direction of word rotation at Step 2.2 and Step 3 


in GFN_{4,r}. 
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GFNINV (4,r)(RK (0), ..., RK_{2r-1}, X0, Xl, X2, X3) 


input : 32-bit round keys RK (0), ..., RK_{2r-1}, 
32-bit data X0, X1, X2, X3, 


output: 32-bit data YO, Y1, Y2, Y3 
Step 1. TO | T1 | T2 | T3 <- X0 | x1 | x2 | x3 
Step 2. For i = 0 to r - 1 do the following: 


Step 2.1. T1 <- T1 XOR FO(RK (2(r - i) - 2}, TO), 
T3 <- T3 XOR F1(RK_{2(r - i) - 1), T2) 


Step 2.2. TO | T1 | T2 | T3 <- T3 | TO | T1 | T2 
Step 3. Y0 | y1 | y2 | Y3 <- T1 | T2 | T3 | TO 
4.2. F-Functions 
Two F-functions F0 and F1 used in GFN_{d,r} are defined as follows: 
FO (RK, x) 
input : 32-bit round key RK, 32-bit data x, 
output: 32-bit data y 


Step 1. T <- RK XOR x 


Step 2. Let T = TO | T1 | T2 | T3, where Ti is 8-bit data, 
TO <- SO(TO), 
Tl «- S1(T1), 
T2 <- SO(T2), 
T3 «- S1(T3) 


Step 3. Let y = y0 | yl | y2 | y3, where yi is 8-bit data, 
y <- MO trans((TO, T1, T2, T3)) 
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F1(RK, x) 
input : 32-bit round key RK, 32-bit data x, 
output: 32-bit data y 
Step 1. T «- RK XOR x 


Step 2. Let T - TT | T2 | T3, where Ti is 8-bit data, 
TO «- S 
T1 <- S 
T2 <- S 
S 


T3 «- 


Step 3. Let y = y0 | yl | y2 | y3, where yi is 8-bit data, 
y <- M1 trans((TO, T1, T2, T3)) 


SO and S1 are nonlinear 8-bit S-boxes, and MO and M1 are 4x4 
diffusion matrices described in the following section. In each 
F-function, two S-boxes are used in the different order, and a 
different matrix is used. 


4.3.  S-Boxes 


CLEFIA employs two different types of 8-bit S-boxes: SO is based on 
four 4-bit S-boxes, and S1 is based on the inverse function over 
GF(2^8) [CLEFIA1]. 


Tables 1 and 2 show the output values of SO and S1, respectively. In 
these tables, all values are expressed in hexadecimal form. For an 
8-bit input of an S-box, the upper 4 bits indicate a row and the 
lower 4 bits indicate a column. For example, if a value Oxab is 
input, 0x7e is output by SO because it is on the cross line of the 
row indexed by "a." and the column indexed by ".b". 
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Table 1: S-Box SO 
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4. 


5. 


Du 


4. Diffusion Matrices 


The multiplications of a diffusion matrix MO or M1, and a vector T in 
Section 4.2, are obtained as follows. 


y = MO trans((TO, T1, T2, T3)): 


y0 = TO XOR (0x02 * T1) XOR (0x04 * T2) XOR (0x06 * T3), 
yl = (0x02 * TO) XOR T1 XOR (0x06 * T2) XOR (0x04 * T3), 
y2 = (0x04 * TO) XOR (0x06 * T1) XOR T2 XOR (0x02 * T3), 
y3 = (0x06 * TO) XOR (0x04 * T1) XOR (0x02 * T2) XOR T3 


y = MI trans((TO, T1, T2, T3)): 


y0 = TO XOR (0x08 * T1) XOR (0x02 * T2) XOR (0x0a * T3), 
yl = (0x08 * TO) XOR T1 XOR (0x0a * T2) XOR (0x02 * T3), 
y2 = (0x02 * TO) XOR (0x0a * T1) XOR T2 XOR (0x08 * T3), 
y3 = (0x0a * TO) XOR (0x02 * T1) XOR (0x08 * T2) XOR T3 


In the above equations, * denotes a multiplication in GF(2^8) defined 
by the lexicographically first primitive polynomial 

z^8 + z^4 + z^3 + z^2 + 1. The constants 0x02, 0x04, 0x06, 0x08, and 
0x0a are represented in hexadecimal form of finite field polynomials. 
For example, 0x02 identifies the finite field element z.  8-bit data 
Ti is also interpreted as a finite field element. 


The mathematical background of two diffusion matrices and their 
choices are explained in [CLEFIA2]. 


Data Processing Part 
1. Encryption/Decryption 


The data processing part of CLEFIA consists of ENCr for encryption 
and DECr for decryption.  ENCr and DECr are based on the 4-branch 
generalized Feistel structure GEN (4,r). Let P,C be 128-bit 
plaintext and ciphertext, and let Pi, Ci (0 <= i < 4) be divided 
32-bit plaintexts and ciphertexts where P = PO | P1 | P2 | P3 and 

C = C0 | c1 | c2 | C3, and let WKO, WK1, WK2, WK3 be 32-bit whitening 
keys and RK (i) (0 <= i < 2r) be 32-bit round keys provided by the 
key scheduling part. Then, r-round encryption function ENCr is 
defined as follows: 
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Step 1. TO | T1 | T2 | T3 <- PO | (P1 XOR WKO) | P2 | (P3 XOR WK1) 
Step 2. TO | T1 | T2 | T3 

<- GEN (4,r)(RK (0), ..., RK_{2r-1}, TO, T1, T2, T3) 
Step 3. co | c1 | c2 | e3 <- ro | (T1 XOR WK2) | T2 | (T3 XOR WK3) 


The decryption function DECr is defined as follows: 


Step 1. TO | T1 | T2 | r3 <- CO | (C1 KOR wk2) | C2 | (C3 XOR WK3) 
Step 2. TO | T1 | T2 | T3 

<- GFNINV_{4,r}(RK_{0}, ..., RK (2r-1), TO, Tl, T2, T3) 
Step 3. PO | P1 | P2 | P3 <- TO | (T1 XOR WKO) | T2 | (T3 XOR WK1) 


5.2. The Numbers of Rounds 
The number of rounds, r, is 18, 22, and 26 for 128-bit, 192-bit, and 
256-bit keys, respectively. The total number of RK (i) depends on 
the key length. The data processing part requires 36, 44, and 52 
round keys for 128-bit, 192-bit, and 256-bit keys, respectively. 

6. Key Scheduling Part 
The key scheduling part of CLEFIA supports 128-bit, 192-bit, and 
256-bit keys and outputs whitening keys WKi (0 <= i < 4) and round 
keys RK_{j} (0 <= j < 2r) for the data processing part. 

6.1. DoubleSwap Function 


We first define the DoubleSwap function, which is used in the key 
Scheduling part. 


The DoubleSwap Function Sigma (X): 
For 128-bit data X, 


Y = Sigma (X) 
= X[7-63] | X[121-127] | X[0-6] | x[64-120], 


where X[a-b] denotes a bit string cut from the a-th bit to the b-th 
bit of X. Bit 0 is the most significant bit. 


Katagi & Moriai Informational [Page 10] 


RFC 6114 The 128-Bit Blockcipher CLEFIA March 2011 


6.2. Overall Structure 


The key scheduling part of CLEFIA provides whitening keys and round 
keys for the data processing part. Let K be the key and L be an 
intermediate key, and the key scheduling part consists of the 
following two steps. 


1. Generating L from K. 
2. Expanding K and L (Generating WKi and RK_{j}). 


To generate L from K, the key schedule for a 128-bit key uses a 
128-bit permutation GFN (4,12), while the key schedules for 
192/256-bit keys use a 256-bit permutation GFN (8,10). 


6.3. Key Scheduling for a 128-Bit Key 


The 128-bit intermediate key L is generated by applying GFN (4,12], 
which takes twenty-four 32-bit constant values CON 128[i] (0 <= i 

< 24) as round keys and K = KO | K1 | K2 | K3 as an input. Then, K 
and L are used to generate WKi (0 <= i < 4) and RK_{j} (0 <= j < 36) 
in the following steps. In the latter part, thirty-six 32-bit 
constant values CON 128[i] (24 <= i < 60) are used. The generation 
steps of CON_128[i] are explained in Section 6.6. 


(Generating L from K) 
Step 1. L <- GFN (4,12) (CON 128[0], ..., CON 128[23], KO, ..., K3) 
(Expanding K and L) 
Step 2. WKO | WK1 | wK2 | WK3 <- K 
Step 3. For i = 0 to 8 do the following: 
T «- L XOR (CON 128[24 + 4i] | CON 128[24 + 4i + 1] 
| CON 128[24 + 4i + 2] | CON 128[24 + 4i + 3]) 
L «- Sigma(L) 
if i is odd: T «- T XOR K 
RK (4i) | RK (4i + 1) | RE (41 + 2} | RR (4i + 3) <- T 
6.4. Key Scheduling for a 192-Bit Key 
Two 128-bit values KL and KR are generated from a 192-bit key K = KO 
| K1 | K2 | K3 | K4 | K5, where Ki is 32-bit data. Then, two 128-bit 


values LL and LR are generated by applying GFN (8,10), which takes 
CON 192[i] (0 <= i < 40) as round keys and KL|KR as a 256-bit input. 
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Then, KL,KR and LL,LR are used to generate WKi (0 <= i < 4) and 
RK (3) (0 <= j < 44) in the following steps. In the latter part, 
forty-four 32-bit constant values CON 192[i] (40 <= i < 84) are used. 


The following steps show the 192-bit/256-bit key scheduling. For the 
192-bit key scheduling, the value of k is set as 192. 


6.5. Key Scheduling for a 256-Bit Key 


The key scheduling for a 256-bit key is almost the same as that for a 
192-bit key, except for constant values, the required number of RKi, 
and the initialization of KR. 


For a 256-bit key, the value of k is set as 256, and the steps are 
almost the same as in the 192-bit key case. The difference is that 
we use CON 256[i](0 <= i < 40) as round keys to generate LL and LR, 
and then to generate RK_{j} (0 <= j < 52), we use fifty-two 32-bit 
constant values CON_256[i] (40 <= i « 92). 


(Generating LL,LR from KL,KR for a k-bit key) 
Step 1. Set k = 192 or k = 256 


Step 2. If k = 192 
KL <- KO | K1 | K2 | K3, KR <- K4 | K5 | “KO | “K1 
else if k = 256 
KL <- KO | k1 | K2 | K3, KR <- K4 | K5 | K6 | K7 


Step 3. Let KL = KLO | KL1 | KL2 | KL3 
KR = KRO | KR1 | KR2 | KR3 
LL|LR <- 
GFN_(8,10)(CON_k[0] , ..., CON_k[39], 
KLO, ..., KL3, KRO, ..., KR3) 


(Expanding KL,KR and LL,LR for a k-bit key) 


Step 4. WKO | WK1 | WK2 | WK3 <- KL XOR KR 
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Step 5. For i= 0 to 10 (if k = 192), 
or 12 (if k = 256) do the following: 


If (i mod 4) = 0 or 1: 
T «- LL XOR (CON k[40 + 4i] | CON k[40 + 4i + 1] 
| CON k[40 + 4i + 2] | CON k[40 + 4i + 3]) 
LL <- Sigma (LL) 
if i is odd: T «- T XOR KR 
else: 
T «- LR XOR (CON k[40 + 4i] | CON k[40 + 4i + 1] 
| CON k[40 + 4i + 2] | CON k[40 + 4i + 3]) 
LR <- Sigma (LR) 
if i is odd: T «- T XOR KL 


RK (4i) | RK (4i + 1) | RE (41 + 2} | RK_{4i 3) <- T 
6.6. Constant Values 


32-bit constant values CON k[i] are used in the key scheduling 
algorithm. We need 60, 84, and 92 constant values for 128-bit, 
192-bit, and 256-bit keys, respectively. Let P(16) = Oxb7el 

(= (e-2)2^16) and Q(16) = 0x243f (= (pi-3)2^16), where e is the base 
of the natural logarithm (2.71828...) and pi is the circle ratio 
(3.14159...). CON k[i], for k = 128,192,256, are generated as 
follows (see Table 3 for the repetition numbers l k and the initial 
values IV k). 


Step 1. T k[0] «- IV k 
Step 2. For i = 0 to 1_k - 1 do the following: 
Step 2.1. CON k[2i] <- (T k[i] XOR P) | (CT kli] <<< 1) 
Step 2.2. CON k[2i + 1] <- (CT k[i] XOR Q) | (T. k[i] <<< 8) 
Step 2.3. T k[i + 1] <- T k[i] * (0x0002^(-1)) 
In Step 2.3, the multiplications are performed in the field GF(2%16) 
defined by a primitive polynomial z^16 + z^15 + z^13 + z^ll + z^5 + 
z^4 + 1 (=0x1a831). 0x0002^(-1) denotes the multiplicative inverse 


of the finite field element z. The selection criteria of IV and the 
primitive polynomial are shown in [CLEFIA1]. 
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Table 3: Required Numbers of Constant Values 


k # of CON k[i] lk IV k 
128 60 30 0x428a 
192 84 42 0x7137 
256 92 46 Oxb5c0 


Tables 4-6 show the values of T_k[i] (k = 128,192,256), and Tables 7-9 
show the values of CON k[i](k = 128,192,256). 


Table 4: T_128[i] 


i 0 T 2 3 4 5 6 7 
T_128[i] 428a 2145 c4ba 625d e536 729b ed55 a2b2 
i 8 9 10 11 12 13 14 15 
T 128[i] 5159 fcb4 “Teba 3f2d cb8e 65c7 e6fb a765 
i 16 17 18 19 20 21 22 23 
T 128[i] 87aa 43d5 f5f2 Taf9 e964 74b2 3a59 c934 
i 24 25 26 21 28 29 


T 128[i] 649a 324d cd3e 669f e757 a7b3 


Table 5: T 192[i] 


i 0 1 2 3 4 5 6 7 
T 192[i] 7137 ec83 a259 8534 429a 214d c4be 625f 
i 8 9 10 11 12 13 14 15 
T_192[i] e537 a683 8759 97b4 4bda 25ed c6ee 6377 
i 16 17 18 19 20 21 22 23 
T 192[i] e5a3 a6c9 877c 43be 21df c4f7 b663 8f29 
i 24 25 26 27 28 29 30 31 
T 192[i] 938c 49c6 24e3 c669 b72c 5b96 2dcb c2fd 
i 32 33 34 35 36 37 38 39 
T 192[i] b566 5ab3 £941 a8b8 545c 2a2e 1517 de93 
i 40 41 
T 192[i] bb51 89b0 
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Table 6: T 256[i] 


i 0 1 
T 256[i] b5c0 5ae0 
i 8 9 
T 256[i] beal 8b48 
i 16 17 
T 256[i] cf8d b3de 
i 24 25 
T 256[i] 9b17 9993 
i 32 33 
T 256[i] d0db bc75 
al 40 41 


T 256[i] Of69 d3ac 


Table 7: CON 128[i] 


i 0 
CON 128[i] f56b7aeb 
i 4 
CON 128[i] 735b768a 
i 8 
CON 128[i] 52d73592 
i 12 
CON 128[i] 5ab42554 

i 16 
CON 128[i] e6b85d4d 
d: 20 
CON 128[i] c9bb034b 

i 24 
CON 128[i] 7c6f68e2 
i 28 
CON 128[i] 511a3208 

i 32 
CON 128[i] 304bf0aa 
i 36 
CON 128[i] 4213141a 
i 40 
CON 128[i] 5e852d36 
i 44 
CON 128[i] 8db88b4d 
i 48 
CON 128[i] d37b36cb 

i 52 
CON_128[i] 7adf6582 
i 56 
CON 128[i] 50563150 
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2 3 4 5 6 7 
2d70 1658 0b5c 05ae 02d7 d573 
10 11 12 13 14 15 
45a4 22d2 1169 dcac 6e56 372b 
18 19 20 21 22 23 
59ef f8ef a86f 802f 940f 9elf 
26 21 28 29 30 31 
98d1 9870 4c38 261c 130e 0987 
34 35 36 37 38 39 
8a22 4511 £690 7048 3da4 led2 

42 43 44 45 
69d6 34eb ce6d b32e 
(0 <= i < 60) 

1 2 3 
994a8a42 96a4bd75 fa854521 
5 6 y 
1f7abac4 d5bc3b45 b99d5d62 
9 10 Ti 
3ef636e5 c57alac9 a95b9b72 
13 14 15 
369555ed 1553ba9a 7972b2a2 
14 18 19 
8a995951 45550696 2774b4fc 
21 22 23 
a59a5a7e 88cc81a5 e4ed2d3f 
25 26 21 
104e8ecb d2263471 be07c765 
29 30 31 
3d3bfbe6 1084b134 7ca565a7 
33 34 35 
5c6aaa87 £4347855 9815d543 
37 38 39 
2e32f2f5 cd180a0d a139f97a 
41 42 43 
32a464e9 c35316%b af72b274 
45 46 47 
el99593a 7ed56d96 12f434c9 
49 50 51 
bf5a9a64 85ac9b65 e98d4d32 
53 54 55 
16fe3ecd d17e32c1 bddf9f66 
57 58 59 
3c9757e7 105250098 7c73b3a7 
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Table 8: CON 192[i] (0 <= i < 84) 


i 0 1 2 3 
CON 192[i] c6d61d91 aaf73771 5b6226f8 374383ec 
X 4 5 6 7 
CON 192[i] 15b8bb4c 799959a2 32d5f596 5ef43485 
i 8 9 10 PE 
CON 192[i] f57b7acb 995a9a42 96acbd65 fa8d4d21 
i 12 t3 14 15 
CON 192[i] 735f7682 1f7ebec4 d5be3b41 b99f5f62 
i 16 17 18 19 
CON 192[i] 52d63590 3ef737e5 1162b2f8 7d4383a6 

i 20 21 22 23 
CON 192[i] 30b8f14c 5c995987 2055d096 4c74b497 
i 24 25 26 27 
CON 192[i] fc3b684b 901ada4b 920cb425 fe2ded25 

à 28 29 30 31 
CON 192[i] 710f7222 1d2eeec6 d4963911 b8b77763 
i 32 33 34 35 
CON 192[i] 52423458 3e63a3e5 1128b26c 7d09c9a6 
Ï 36 37 38 39 
CON 192[i] 309df106 5cbc7c87 f45f7883 987ebe43 
i 40 41 42 43 
CON 192[i] 963ebc41 falfdf21 73167610 1f37f7c4 
zh 44 45 46 47 
CON 192[i] 01829338 6da363b6 38c8elac 54e9298f 

i 48 49 50 51 
CON 192[i] 246dd8e6 484c8c93 fe276c'73 9206c649 
d: 52 53 54 55 
CON 192[i] 930250639 ff23e324 7188732c 1da969c6 

i 56 57 58 59 
CON 192[i] 00cd91a6 6cec2cb7 ec7748d3 8056965b 
i 60 61 62 63 
CON 192[i] 9a2aa469 f60bcb2d 751c7a04 193dfdc2 

i 64 65 66 67 
CON 192[i] 02879532 6ea666b5 ed524a99 8173b35a 
i 68 69 70 71 
CON 192[i] 4ea00d7c 228141f9 1f59ae8e 7378b8a8 
ah 72 73 74 75 
CON 192[i] e3bd5747 8f9c5c54 9dcfaba3 flee2e2a 
a: 76 77 78 79 
CON 192[i] a2f6d5d1 ced71715 697242d8 055393de 
i 80 81 82 83 
CON 192[i] 0cb0895c 609151bb 3e51lec9e 52700089 
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Table 9: CON 256[i] (0 <= i « 92) 


i 0 1 2 3 

CON 256[i] 0221947e 6e00c0b5 ed014a3f 8120e05a 

d 4 5 6 7 

CON 256[i] 9a91a51f f6b0702d a159d28f cd78b816 

i 8 9 10 T4 

CON 256[i] bcbde947 d09c5c0b b24ff4a3 de6eae05 

i 12 13 14 15 

CON 256[i] b536fa51 d917d702 62925518 0eb373d5 

i 16 EJ 18 19 

CON 256[i] 094082bc 6561albe 3ca9e96e 5088488b 
zh 20 21 22 23 

CON 256[i] £24574b7 9e64a445 9533ba5b £912d222 

i 24 25 26 21 

CON 256[i] a688dd2d caa96911 6b4d46a6 076cacdc 
i 28 29 30 31 

CON 256[i] d9b72353 b596566e 80ca91a9 eceb2b37 

à 32 33 34 35 

CON 256[i] 786c60e4 144d8dcf 043f9842 681edeb3 

Ï 36 37 38 39 

CON 256[i] ee0e4c21 822fef59 4f0e0e20 232feff8 

i 40 41 42 43 

CON 256[i] 1f8eaf20 73af6fa8 37ceffa0 5bef2f80 

i 44 45 46 47 

CON 256[i] 23eed7e0 4fcf0f94 29fec3c0 45dflf9e 
i 48 49 50 51 

CON 256[i] 2cf6c9d0 40d7179b 2e72ccd8 42539399 

a: 52 53 54 55 

CON 256[i] 2f30ce5c 4311d198 2f91cfle 43b07098 
i 56 57 58 59 

CON 256[i] fbd9678f 97f8384c 91fdb3c7 fddclc26 

d: 60 61 62 63 

CON 256[i] a4efd9e3 c8ce0e13 be66ecfl d2478709 
i 64 65 66 67 

CON 256[i] 673a5e48 Oblbdbd0 05948714 67b575bc 

i 68 69 70 71 

CON 256[i] 3dc3ebba 51e2228a f2f075dd 9ed11145 

al: 72 73 74 v5 

CON 256[i] 417112de 2d5090f6 cca9096f a088487b 

i 76 77 78 79 

CON 256[i] 8a4584b7 e664a43d a933c25b c512d21e 

Ï 80 81 82 83 

CON 256[i] b888e12d d4a9690f 644d58a6 086cacd3 
i 84 85 86 87 

CON 256[i] de372c53 b216d669 830a9629 ef2beb34 

i 88 89 90 91 

CON 256[i] 798c6324 15ad6dce 04cf99a2 68ee2eb3 
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7. 


Security Considerations 


The security of CLEFIA has been scrutinized in the public community, 
but no security weaknesses have been found for full-round CLEFIA to 
date, neither by the designers nor by independent cryptographers. 
Security evaluation by the designers is described in [CLEFIA3], and a 
list of published cryptanalysis results by external cryptographers is 
available from 
http://www.sony.net/Products/cryptography/clefia/technical/ 

related material.html. 
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Appendix A. Test Vectors 


In this appendix, we give test vectors of CLEFIA for each key length. 
The data are expressed in hexadecimal form. For the intermediate 
values of these vectors, refer to Appendix B. 


128-bit key: 
key ffeeddcc bbaa9988 77665544 33221100 


plaintext 00010203 04050607 08090a0b 0c0d0e0f 
ciphertext de2bf2fd 9b74aacd £1298555 459494fd 


192-bit key: 

key ffeeddcc bbaa9988 77665544 33221100 
f0e0d0cO b0a09080 

plaintext 00010203 04050607 08090a0b 0c0d0e0f 

ciphertext e2482f64 9f028dc4 80dda184 fdel81ad 

256-bit key: 

key ffeeddcc bbaa9988 77665544 33221100 
f0e0d0cO b0a809080 70605040 30201000 

plaintext 00010203 04050607 08090a0b 0c0d0e0f 

ciphertext a1397814 289de80c 10da46d1 fa48b38a 


Appendix B. Test Vectors (Intermediate Values) 


128-bit key: 


key ffeeddcc bbaa9988 77665544 33221100 
plaintext 00010203 04050607 08090a0b 0c0d0e0f 
ciphertext de2bf2fd 9b74aacd £1298555 459494fd 
L 8£89a61b 9db9d0f3 93e65627 da0d027e 
WK (0,1,2,3) ffeeddcc bbaa9988 77665544 33221100 
RK_{0,1,2, 3} f3e6cef9 8df75e38 41c06256 640ac51b 
RK_{4,5,6,7} 6a27e20a 5a791b90 e8c528dc 00336ea3 
RK_{8,9,10,11} 59cd17c4 28565583 312a37cc c08abd77 
RK_{12,13,14,15} 7e8e7eec 8be7e949 d3f463d6 a0aad6aa 
RK_{16,17,18,19} e75eb039 0d657eb9 018002e2 9117d009 
RK_{20,21,22,23} 9f98dlle babee8cf b0369efa d3aaef0d 
RK_{24,25,26,27} 3438f93b f9cea4a0 68df9029 b869b4a7 
RK_{28,29,30,31} 24d6406d e74bc550 41c28193 16de4795 
RK_{32,33,34,35} a34a20f5 33265d14 b19d0554 5142f434 
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Round 18 input de2bf2fd 4065c77b £1298555 64664dd0 

F-function FO F1 

input de2bf2fd £1298555 

round key b19d0554 5142f434 

after key add 6fb6f7a9 a06b7161 

after S b44d648c 7e99ea2a 

after M ac7738£2 12d0c82d 
output de2bf2fd ec12ff89 £1298555 76b685fd 
final whitening key 77665544 33221100 
after whitening de2bf2fd 9b74aacd £1298555 459494fd 
ciphertext de2bf2fd 9b74aacd £1298555 459494fd 


192-bit key: 


key ffeeddcc bbaa9988 77665544 33221100 
f0e0d0cO b0a09080 

plaintext 00010203 04050607 08090a0b 0c0d0e0f 
ciphertext e2482f64 9f028dc4 80dda184 fdel8lad 
LL db05415a 800082db 7cb8186c d788c5f3 
LR 1ca9b2el1 b4606829 c92dd35e 2258a432 
WK_{0,1,2,3} Of0e0d0c 0b0a0908 77777777 77777777 
RK_{0,1,2,3} 4d3bfdlb 7alf5dfa Ofae6e7c c8bf3237 
RK_{4,5,6,7} 73c2eeb8 dd429ec5 e220b3af c9135e73 
RK, (8,9,10,11) 38c46a07 fc2ce4ba 370abf2d b05e627b 
RK_{12,13,14,15} 38351b2f 74bd6ele 1b7c7dce 92cfc98e 
RK (16,17,18,19) 509b31a6 4c5ad53c 6fc2ba33 ele5c878 
RK_{20,21,22,23} 419a74b9 1dd79e0e 240a33d2 9dabfd09 
RK_{24,25,26,27} 6e3ff82a 74ac3ffd b9696e2e cc0b3a38 
RK_{28,29,30,31} ed785cbd 9c077c13 04978d83 2ec058ba 
RK_{32, 33,34,35} 4bbd5f6a 31fe8de8 b76da574 3a6fa8e7 
RK_{36, 37,38,39} 521213ce 4f1f59d8 c13624f6 ee91f6a4 
RK_{40, 41,42, 43} 17f68fde f6c360a9 6288bc72 c0ad856b 
plaintext 00010203 04050607 08090a0b 0c0d0e0f 
initial whitening key 0£0e0d0c 050230908 
after whitening 00010203 0b0b0b0b 08090a0b 07070707 
Round 1 input 00010203 0b0b0b0b 08090a0b 07070707 

F-function FO F1 

input 00010203 08090a0b 

round key 4d3bfdlb 7alf5dfa 

after key add 4d3aff18 72165711 

after S 43c58e9e ed85d736 

after M b5021a3b c397£62b 
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Round 8 input 3af5f8b8 clell40a 16ce743f e52f44c9 
F-function FO F1 
input 3af5f8b8 16ce743f 
round key 1b7c7dce 92cfc98e 
after key add 21898576 8401bdb1 
after S al18dc09 3949b1£3 
after M £091202d 04f9e827 
Round 9 input 31703427 16ce743f eld6acee 3af5f8b8 
F-function FO Fl 
input 31703427 eld6acee 
round key 509b31a6 4c5ad53c 
after key add 61eb0581 ad8c79d2 
after S 2a8d3304 eeffc072 
after M £9639a90 8bebfe3d 
Round 10 input efadeeaf eld6acee b11e0685 31703427 
F-function FO F1 
input efadeeaf b11e0685 
round key 6fc2ba33 ele5c878 
after key add 806f549c 50fbcefd 
after S cd5eeb61 2547fe02 
after M al00e35b 26a4el6d 
Round 11 input 40d64fb5 b11e0685 17d4d54a efadeeaf 
F-function FO F1 
input 40d64fb5 17d4d54a 
round key 419a74b9 1dd79e0e 
after key add 014c3b0c 0a034b44 
after S 49a4c013 b4c6c912 
after M 51c0208f f1a2c339 
Round 12 input e0de260a 17d4d54a 1e0f2d96 40d64fb5 
F-function FO ET 
input e0de260a 1e0f2d96 
round key 240a33d2 9dabfd09 
after key add c4d415d8 83a4d09f 
after S 801beebe 86b8f8ed 
after M 8a9aef34 3e451646 
Round 13 input 9d4e3a7e 1e0f2d96 7e9359f3 e0de260a 
F-function FO F1 
input 9d4e3a7e 7e9359f3 
round key 6e3ff82a 74ac3ffd 
after key add £371c254 0a3f660e 
after S 29ea68e8 b4f530a8 
after M 17524741 4b8c607e 
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Round 20 input e6f68dc9 a6ba2e9f 98a8a539 63eb9287 
F-function FO F1 
input e6f68dc9 98a8a539 
round key c13624f6 ee91f6a4 
after key add 27c0a93f 7639539d 
after S 20b5938b 09893194 
after M 3cae819e b603c454 
Round 21 input 9al4af01 98a8a539 d5e856d3 e6f68dc9 
F-function FO F1 
input 9al4af01 d5e856d3 
round key 17f68fde f6c360a9 
after key add 8de220df 232b367a 
after S 6666bff2 b383albd 
after M 7ae08a5d 662b2c4d 
Round 22 input e2482f64 d5e856d3 80dda184 9al14af01 
F-function FO Fl 
input e2482f64 80dda184 
round key 6288bc72 c0ad856b 
after key add 80c09316 407024ef 
after S cdb5fle5 fbe99290 
after M 3d9dac60 108259db 
output e2482f64 e875fab3 80dda184 8a96f6da 
final whitening key E ETEN T7777777 
after whitening e2482f64 9f028dc4 80dda184 fdel8lad 
ciphertext e2482f64 9f028dc4 80dda184 fdel8lad 
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256-bit key: 


key ffeeddcc bbaa9988 77665544 33221100 
f0e0d0cO b0a09080 70605040 30201000 
plaintext 00010203 04050607 08090a0b 0c0d0e0f 
ciphertext a1397814 289de80c 10da46d1 fa48b38a 
LL 477e8f09 66ee5378 2cc2be04 bf55e28f 
LR d6c10b89 4eeab575 84bd5663 cc933940 
WK_{0,1,2,3} Of0e0d0c 0b0a0908 07060504 03020100 
RK_{0,1,2,3} 58£02029 15413cd0 1b0c41a4 e4bacd0Of 
RK_{4,5,6,7} 6c498393 8846231b 1fc716fc 7c81a45b 
RK- (8,9,10,11) fa37c259 0e3da2ee aacf9abb 8ec0aad9 
RK_{12,13,14,15} b05bd737 8delf2d0 8ffee0f6 b70b47ea 
RK_{16,17,18,19} 581b3e34 03263f89 2£7100cd 05cee171 
RK_{20,21,22,23} b523d4e9 176d7c44 6d7ba5d7 £797b2f3 
RK_{24,25,26,27} 25d80df2 a646bba2 6a3a95el 3e3a47f0 
RK_{28,29,30,31} b304eb20 44f8824e c7557cbc 47401e21 
RK_{32, 33,34,35} d71ff7e9 acalfb0c 2deff35d 6ca3a830 
RK_{36, 37, 38,39} 4Add7cfb7 ae71c9f6 4e911fef 90aa95de 
RK_{40, 41,42, 43} 2c664a7a 8cb5cf6b 14c8dele 43b9caef 
RK_{44,45, 46,47} 568c5a33 07ef7ddd 608dc860 ac9e50f8 
RK_{48,49,50,51} c0c18358 4f53c80e 33e01cb9 8025lelc 
plaintext 00010203 04050607 08090a0b 0c0d0e0f 
initial whitening key 0£0e0d0c 050230908 
after whitening 00010203 0b0b0b0b 08090a0b 07070707 
Round 1 input 00010203 0b0b0b0b 08090a0b 07070707 
F-function FO F1 
input 00010203 08090a0b 
round key 58£02029 15413cd0 
after key add 58f1222a 1d4836db 
after S 4ee41927 2c78alac 
after M 2db2101b d87ee718 
Round 2 input 26b91b10 08090a0b df79e01f 00010203 
F-function FO F1 
input 26b91b10 df79e01f 
round key 1b0c41a4 e4bacdOf 
after key add 3db55ab4 3bc32d10 
after S aabafadb 0£1e1928 
after M 317e029c c0cc96ba 
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Round 15 input 212a2484 988db861 847415b0 f663d9ff 
F-function FO F1 
input 212a2484 84741550 
round key b304eb20 44f8824e 
after key add 922ecfa4 c08c97fe 
after S 86d2c9a0 b5ff£56 7d 
after M dbf56073 87e2a6a2 
Round 16 input 43784812 847415b0 71817f£5d 212a2484 
F-function FO Fl 
input 437848812 71817f5d 
round key c7557cbc 47401e21 
after key add 842da4ae 36c1617c 
after S 9e19b889 al0c5414 
after M 6791a3e3 e177d3a8 
Round 17 input e3e5b653 71817f5d c05df72c 4378d812 
F-function FO Fl 
input e3e5b653 c05df72c 
round key d71ff7e9 acalfb0c 
after key add 34fa4lba 6cfc0c20 
after S d4elbe2d 32bc13bf 
after M 2743ef2d 6fecOaab 
Round 18 input 56c29070 c05df72c 2c94d2b9 e3e5b653 
F-function FO F1 
input 56c29070 2c94d2b9 
round key 2deff35d 6ca3a830 
after key add 7b2d632d 40377a89 
after S 56193719 fb13c1b7 
after M ee6316fa 5e3245b7 
Round 19 input 2e3eeld6 2c94d2b9 bdd7f3e4 56c29070 
F-function FO F1 
input 2e3eeld6 bdd7f3e4 
round key 4dd7cfb7 ae71c9f6 
after key add 63e92e61 13a63a12 
after S 373c4c54 8fe6c54b 
after M 87aab08e 8f8d16£3 
Round 20 input ab3e6237 bdd7f3e4 d94f8683 2e3eeld6 
F-function FO F1 
input ab3e6237 d94f8683 
round key 4e911fef 90aa95de 
after key add e5af7dd8 49e5135d 
after S f6ad88be 65£68£77 
after M 0889d£33 f418c84f 
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Round 21 input b55e2cd7 d94f8683 da262999 ab3e6237 
F-function FO F1 
input b55e2cd7 da262999 
round key 2c664a7a 8cb5cf6b 
after key add 993866ad 5693e6f2 
after S 2c2b6cee 0af150e5 
after M 8999e772 da5415d2 
Round 22 input 50d661f1 da262999 716a77e5 b55e2cd7 
F-function FO Fl 
input 50d661f1 716a77e5 
round key 14c8dele 43b9caef 
after key add 441ebfef 32d3bd0a 
after S 12b052ac c7bbb182 
after M f5efd89e 744a9ced 
Round 23 input 2fc9f107 716a77e5 c114b03a 50d661f1 
F-function FO Fl 
input 2£c9f107 c114b03a 
round key 568c5a33 O7ef7ddd 
after key add 7945ab34 c6fbcde7 
after S a2a77e2a 4cd7e238 
after M e84f6d9b ce67e20a 
Round 24 input 99251a7e c114b03a 9eb183fb 2fc9f107 
F-function FO F1 
input 99251a7e 9eb183fb 
round key 608dc860 ac9e50f8 
after key add f9a8d21e 322fd303 
after S £84572b0 c7d8f1c6 
after M 20634b77 591b3£55 
Round 25 input el77fb4d 9eb183fb 76d2ce52 99251a7e 
F-function FO Fl 
input el77fb4d 76d2ce52 
round key c0c18358 4f53c80e 
after key add 21b67815 39810650 
after S al4dd39c c8e20aa5 
after M 3f88fbef 89ff5caf 
Round 26 input al397814 76d2ce52 10da46d1 e177fb4d 
F-function FO Fl 
input al397814 10da46d1 
round key 33e01cb9 80251elc 
after key add 92d964ad 90ff58cd 
after S 864445ee 9a8e803f 
after M 5949235a 183d49c7 
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